Skip to content
OriginalSign in
Image: Rapid7

Rapid7Rapid7

Patch now: critical VMware vCenter remote code flaws

Part of the CVE-2026-59309 story · since 29 Jul

Quiet for 2 dayslast report 29 Oct6 articles5 outlets
29 Jul · SecurityOnline first15 Sep1 Oct17 OctNowThis article4th of 6
  • Wed 29 Jul, 11:51 UTC. SecurityOnline, first report. Critical VMware vCenter flaw lets hackers bypass authentication.
  • Wed 29 Jul, 11:51 UTC. SecurityWeek, its first report on the story. Broadcom Warns of VMware Flaws Allowing Host Code Execution.
  • Wed 29 Jul, 14:07 UTC. Security Affairs, its first report on the story. Broadcom patches critical VMware flaws, including admin VM escape.
  • Thu 30 Jul, 13:01 UTC. Rapid7, its first report on the story. Patch now: critical VMware vCenter remote code flaws. This article, 4th of 6.
  • Sat 5 Sep, 17:01 UTC. The Hacker News, its first report on the story. Broadcom Patches Critical VMware Flaws Enabling VM-to-Host Code Execution.
  • Thu 29 Oct, 08:30 UTC. SecurityWeek. Chinese Hackers Exploited VMware ESXi Logging Flaw as Zero Day.

On July 29, 2026, Broadcom disclosed two critical vulnerabilities in VMware vCenter Server, CVE-2026-59309 and CVE-2026-59310, both with a CVSSv3.1 score of 9.8. CVE-2026-59309 represents an authentication bypass that allows unauthorized access to the vCenter management plane, while CVE-2026-59310 involves a directory traversal vulnerability that enables remote code execution. Exploitation does not require prior authentication, but attackers must have network access.

There is currently no known proof-of-concept for exploitation, making immediate patching essential as exploitation in the wild could occur. Organizations are urged to apply the updates suggested in Broadcom's security advisory promptly. Rapid7 customers can assess their exposure using specific vulnerability checks.

How the story developed

All 6 articles
Quiet for 2 dayslast report 29 Oct6 articles5 outlets

6 articles from 5 outlets since 29 Jul. Quiet since 29 Oct. This was the 4th report, 1 day after the first.

Now29 Jul315 Sep629 OctFirst reportSecurityOnline · 29 Jul, 11:51This article4th of 6 · day 1Picked up againafter 5 weeks quiet
  • Wed 29 Jul, 11:51 UTC. SecurityOnline, first report. Critical VMware vCenter flaw lets hackers bypass authentication.
  • Wed 29 Jul, 11:51 UTC. SecurityWeek, its first report on the story. Broadcom Warns of VMware Flaws Allowing Host Code Execution.
  • Wed 29 Jul, 14:07 UTC. Security Affairs, its first report on the story. Broadcom patches critical VMware flaws, including admin VM escape.
  • Thu 30 Jul, 13:01 UTC. Rapid7, its first report on the story. Patch now: critical VMware vCenter remote code flaws. This article, 4th of 6.
  • Sat 5 Sep, 17:01 UTC. The Hacker News, its first report on the story. Broadcom Patches Critical VMware Flaws Enabling VM-to-Host Code Execution.
  • Thu 29 Oct, 08:30 UTC. SecurityWeek. Chinese Hackers Exploited VMware ESXi Logging Flaw as Zero Day.
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 6 articles as a list
  1. Wed 29 JulDay 03
    1. Critical VMware vCenter flaw lets hackers bypass authentication11:51 · SecurityOnline · First report
    2. Broadcom Warns of VMware Flaws Allowing Host Code Execution11:51 · SecurityWeek
    3. Broadcom patches critical VMware flaws, including admin VM escape14:07 · Security Affairs
  2. Thu 30 JulDay 11
    1. Patch now: critical VMware vCenter remote code flaws13:01 · Rapid7 · This article, 4th of 6

  3. Quiet for 5 weeks

    Sat 5 SepDay 381
    1. Broadcom Patches Critical VMware Flaws Enabling VM-to-Host Code Execution17:01 · The Hacker News · Picked up again

  4. Quiet for 8 weeks

    Thu 29 OctDay 921
    1. Chinese Hackers Exploited VMware ESXi Logging Flaw as Zero Day08:30 · SecurityWeek · Picked up again

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in